Reading RAW data from a Flash POST Request ( images )

Question

I'm basically interacting with a third party API flash file to send HTTP POST requests to my server.

I know I'm on somewhat the right path because it requires a crossdomain.xml file, and before I added that part nothing in the POST variables was showing up, however since I added that file there are 4 variables that are set, these POST variables are sent by the application to give me basic information about the file.. but I actually need to read the RAW POST data to actually save the image being sent by the Flash.

I'm aware there are 3 ways...

1. $GLOBALS['HTTP_RAW_POST_DATA']
2. $HTTP_RAW_POST_DATA which is probably the same as the first
3. file_get_contents('php://input')

For whatever reason, neither of these "work". By "work" I mean they're not being set, when I var dump them I get nothing.

Could it be that there's a setting in php.ini that I need to set, or perhaps the Flash application is truly not sending the actual image? I think it's doing the right thing, because it's a semi popular API and it's used by a couple other sites so I'm pretty sure it's right on their end.

And they don't require any sort of API key either.

Answer 1

You'll need to set always_populate_raw_post_data=1 in php.ini to use HTTP_RAW_POST_DATA (look here). Also, make sure that you set upload_max_filesize to a value that is large enough for your files.

However, HTTP_RAW_POST_DATA will never work if the POST data is being sent as multipart/form-data, which is usually used when sending files.

Unless you're sending files in a non-standard way, you really should be using $_FILES to retrieve the uploads. PHP automatically saves file uploads into a temporary location and places the location in the $_FILES variable. You can use the move_uploaded_file function to move it to where you want it to be. For example:

$place_to_put_the_file = "/my_directory/image.jpg";
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
 echo "File is valid, and was successfully uploaded.\n";
} else {
 echo "Possible file upload attack!\n";
}